What problem does it solve? Server-side template injection is easy to miss during manual testing yet often leads directly to remote code execution. This Skill provides a structured methodology for fingerprinting template engines, confirming injection with math-expression probes, and escalating to RCE using engine-specific payloads. ## Core Features & Use Cases - Engine Fingerprinting: Detection payloads like {{77}}, ${77}, and <%= 77 %> distinguish Jinja2, Twig, Freemarker, ERB, Mako, Thymeleaf, and Velocity based on evaluated output. - RCE Escalation: Engine-specific exploitation patterns including Jinja2 class-walker payloads, Twig registerUndefinedFilterCallback, Freemarker Execute utility, and ERB backticks. - Attack Surface Guidance: Identifies high-value injection points such as email templates, PDF generators, CMS previews, invoice fields, and reflected URL parameters. - Use Case: While testing a bug bounty target, you notice a name field reflected in a confirmation email. Submit {{77}}, observe 49 in the rendered output, fingerprint the engine as Jinja2, then escalate with the class-walker payload to prove RCE. ## Quick Start Test the name field on the target's profile page with {{77}} and ${77} to check for server-side template injection.
